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Abstract 

We  consider  a  heuristic  approach  for  combining  short  traffic 
traces  of  various  degrees  of  self-similarity  to  produce  a 
longer  trace  that  has  the  following  desirable  properties.  The 
mixed  trace  is  capable  of  modeling  computer  networking 
traffic  that  exhibits  both  short-  and  long-range  dependence  in 
a  unified  model.  Synthetic  traces  of  self-similar  characteris¬ 
tics  can  be  generated  quickly  due  to  the  simplicity  of  our 
method,  which  is  faster  than  the  traditional  approach  of  gen¬ 
erating/approximating  traffic  traces  from  nothing. 

1  Introduction 

Synthesizing  traces  that  exhibit  self-similarity  is  important 
because  modern  computer  networking  traffic  is  reported  to 
possess  self-similar  (SS)  characteristics  (see  [6]  and  its  refer¬ 
ences).  Several  algorithms,  which  have  complexity  ranging 
from  0(h)  to  O  (n-)  for  approximating/generating  SS 
traces  of  length  n,  are  reviewed  in  [6].  Traditional 
approaches  are  concentrated  on  generating  SS  traces  from 
scratch;  i.e.,  generating  one  data  point  after  another  until  a 
specified  length  is  reached.  In  contrast,  our  method  produces 
a  longer  trace  by  combining  previously  generated  shorter 
traces.  In  comparing  with  many  existing  methods  for  gener¬ 
ating  traces  from  scratch,  our  combining  method  is  orders  of 
magnitudes  faster;  hence  it  can  be  used  to  generate  traces  in 
real  time.  For  example,  we  can  cross-multiply  1000  points  of 
a  given  SS  trace  (a  short  trace)  to  produce  a  new  1,000,000- 
point  trace  (a  much  longer  trace)  that  exhibits  some  degree 
of  self-similarity.  Furthermore,  the  new  method  is  capable  of 
generating  traces  possessing  both  short-  and  long-range 
dependence  at  various  time  scales. 

2  Long-Range  Dependence  and  Self- Similarity 

Let  { X it)  be  a  wide-sense  stationary  (WSS)  process  with 
autocorrelation  r  (n)  and  power  spectral  density  g  (/)  . 
Assume  that  ^  r  (n)  diverges,  then  {  X n }  is  long- 

range  dependent  (LRD)  [otherwise,  if  ^  _  ^  r  (n)  con¬ 
verges,  we  define  {X  }  to  be  short-range  dependent 
(SRD)].Let  {  X  }  be  a  WSS  process  formed  by  averag¬ 
ing  the  process  {  X;;}  in  non-overlapping  blocks  of  m,  i.e., 

X/"0  =  (X,  ,.  +  ...+  X,  )/m. 

k  '  km  -  m  +  1  km 

Then  the  LRD  process  {  Xj; }  is  ( asymptotically )  SS  with 
parameter  0  <  [3  <  1  if  the  following  3  (equivalent)  proper¬ 
ties  hold  [1]: 

var  Xjp")  -  m-P  as  m  — »  °° ,  (1) 


r  (  i)  ~  i  P  as  i  — >  °°  ,  (2) 

£(/)  ~/-(1-P}  as  /^0.  (3) 

One  often  uses  the  rescaled  range  statistic  R/ S  to  esti¬ 
mate  [3  as  follows.  Let  X  and  S2  (n)  be  the  sample  mean 
and  variance  of  {X  }  ,  respectively,  and  let 

Wk  -  Xj  +  ...  +  X^-kX  ,  k  =  1,  ...,  n .  The  R/S  statis¬ 
tic  is  defined  by  R(n)/S(n)  ,  where  R  (n)  = 

max  (0,  W.,  ...,  W  )  -  min  (0 ,  W W  )  .  Then 

E  [R  (n)  /S  (n)]  ~  nH  as  n  — >  °° ,  (4) 

where  H  -  1  -  p/2  is  the  Hurst  parameter.  H  is  a  measure 
for  burstiness;  i.e.,  the  higher  H  (or  lower  P )  the  burstier  the 
process  [2],  The  underlying  WSS  process  is  SRD  when 
H  =  0.5  and  LRD  otherwise.  The  following  result  shows 
that  self-similarity  is  both  persistent  and  dominating  in  heter¬ 
ogenous  networking  environment. 

Theorem  1:  The  asymptotic  behavior  of  a  process  formed  by 
multiplexing  two  SS  processes  will  be  that  of  the  burstier 
one. 

Proof.  Let  { Z n}  =  {  Xj;  +  Y }  be  the  sum  process,  where 
{Xn}  and  {  Y  n }  are  two  component  SS  processes  of 
parameters  p  ^  and  P2,  respectively.  We  also  assume  that 
{X  }  and  {Y  }  are  jointly  WSS;  i.e.,  E  {X  .  Y  }  and 
E{X  Y  A  depend  only  on  k.  The  WSS  aggregated  pro¬ 
cess  {  Zlm)  }  then  has  the  variance 


varZ.L”)  =  varX.L")  +  varT  .("*)  + 

l  l  l 

2 a  (varX/m)var YW)  1/2 ,  (5) 

where  a  is  the  correlation  coefficient  of  XL")  and  T(m) 

l  l  ’ 

which  is  bounded  (i.e.,  |a|  <  1 ).  Since  the  component  pro¬ 
cesses  are  asymptotically  SS,  when  m  — >  °° ,  (5)  becomes 


varZ,' 


-*■"7  — »  a^m  ^l+a^m  +  a^am  ^ +  ^2^ /2  _ 


where  a.  are  positive  constants  [see  (1)].  When  m— >°°, 
var ZSm>  —>  a^m  1  2  ,  tor  some  positive  a4  ;  there¬ 
fore,  {Z  }  is  asymptotically  SS  by  (1).  Q.E.D. 


3  The  Combining  Algorithm 


Our  goal  is  to  generate  a  synthetic  trace  of  length  N.  where  N 
=  TW  for  some  positive  integers  T  and  W.  That  is  the  entire 
trace  is  composed  of  T  time  windows;  each  window  contains 
W  samples.  Furthermore,  the  required  trace  must  behave  like 
a  SS  process  of  Hurst  parameter  //;  and  it  must  look  like 
another  SS  process  in  each  window  with  Hurst  parameter 
Hw-  To  this  end,  let  {Xp  ....  X^,}  be  a  SS  trace  of  Hurst 
parameter  Hw  and  {Y p  ...,  Y T\  be  (another)  SS  trace  of 
Hurst  parameter  H.  Then  the  required  trace 
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{Zp  Z9,  ...,ZN}  is  simply  the  cross-multiplication  of  all 


elements  of  { X.}  and  {7.}  : 

‘  y,xvY^xT.. 

••  w 

y2xv  y2x2,  . 

YtX j,  ytx2,  .. 

V  Y 

I  Tz\w 

Therefore,  we  need  only  T  +  W  SS  data  points  (which  can 
be  computed  on-line  or  off-line)  and  TW  multiplications  to 
produce  the  longer  trace  of  TW  data  points.  One  can  think 
of  the  integrated  trace  {Z.}  as  a  train  of  time  windows;  all 
windows  share  the  same  level  of  burstiness  (i.e.,  the  same 
Hurst  parameter  Hw).  However,  the  load  intensity  varies 
from  one  window  to  the  next  according  to  a  SS  process  of 
Hurst  parameter  H . 

To  see  how  the  trace  {  Z.}  specified  by  (6)  meets  most  of 
our  objectives,  notice  that  in  the  ;th  window  (of  size  W),  the 
samples  of  {Z.}  are  Y.X^,  Y.X2,  . ...  Y.XW\  therefore, 
{Z.}  is  a  scaled  version  of  X^,X2,  which  has 

Hurst  parameter  Hw. Thus,  {Z.}  also  has  Hurst  parameter 

in  each  time  window  as  desired.  On  the  other  hand,  it  is 

w 

shown  in  [4]  that  the  averages  of  {Z.}  in  non-overlapping 
blocks  of  size  jW  are  Z.O’W)  =  y  )./)  xf w)  ,  where 
X I  "'I  =  (X1  +  X0  +  ...  +  Xw) /W .  Thus  in  large  time 
scales,  {Z.}  retains  some  SS  characteristics  of  {  Y .}  .  In 
other  words,  {Z.}  is  approximately  asymptotically  SS  with 
Hurst  parameter  H .  We  consider  only  2  Hurst  parameters  (// 
and  Hw )  for  the  sake  of  clear  illustration  in  this  paper;  more 
parameters  can  be  incorporated  into  the  model  at  the  cost  of 
increasing  complexity. 

One  often  uses  fractional  Gaussian  noises  (FGNs)  to  gen¬ 
erate  the  two  component  traces  { X .}  and  {  Y .  }  ,  which 
take  negative  and  non-integer  values.  In  the  next  section  we 
will  transform  the  FGNs  to  have  non-negative  integer  values 
as  required  in  computer  networking  applications. 

4  An  Application 

In  this  section  we  apply  the  algorithm  (6)  to  generate  a  non¬ 
negative,  integer-valued  synthetic  trace  that  possesses  both 
SRD  and  LRD  characteristics  in  different  time  scales.  Addi¬ 
tionally,  the  trace  must  satisfy  a  specified  load  constraint  and 
a  level  of  traffic  denseness. 

4.1  Model  Parameters 

Recall  from  Section  3  that  we  need  the  following  4  basic 
parameters  to  generate  a  longer  trace  from  two  shorter 
traces: 

H  —  (global)  asymptotic  Hurst  parameter.  The  generated 
trace  looks  asymptotically  SS  with  Hurst  parameter  H. 
Hw  —  (local)  Hurst  parameter  as  seen  in  each  time  win¬ 
dow.  The  traffic  in  each  time  window  behaves  as  a  SS 
process  of  Hurst  parameter  Hw ,  generally  //  w  ±  H  . 


T  —  the  number  of  time  windows.  The  generated  series 
consists  of  T  time  windows.  Each  window  has  the  same 
degree  of  burstiness  (i.e.,  same  Hurst  parameter  Hw)\ 
and  the  traffic  load  will  change  from  one  window  to  the 
next  according  to  a  SS  process  of  Hurst  parameter  H. 

W  —  window  size.  Each  time  window  has  W  data  points. 

To  refine  the  model  a  bit  further,  we  introduce  2  more 
parameters  as  follows: 

L —  window  maximum  traffic  load.  Cumulative  traffic  in 
each  time  window  can  not  exceed  L.  However,  instanta¬ 
neous  traffic  values  in  finer  time  stamps  can  exceed  the 
corresponding  (translated)  L.  For  example,  the  maximum 
ethernet  load  is  10  Mbps;  however,  in  some  rare  0.1-sec¬ 
ond  interval,  the  load  value  can  exceed  1  Mb  (which  is 
translated  to  the  corresponding  load  that  exceeds  10 
Mbps). 

r  —  an  indicator  of  traffic  denseness,  re  (0,1).  The 
generated  trace  has  lower  peaks  and  shallower  valleys  for 
larger  r  (i.e.,  the  traffic  looks  denser  at  larger  r). 

Our  simple  model  is  meant  to  capture  only  important  traffic 
characteristics  such  as  the  degree  of  SRD/LRD,  the  level  of 
traffic  denseness,  and  the  extent  of  traffic  burstiness.  Traffic 
details  at  microscopic  levels  are  not  considered  here  because 
they  are  application-specific;  however,  one  can  tailor  the 
model  to  fit  the  required  applications.  In  other  words,  we 
model  only  intrinsic  properties  of  the  traffic;  it  is  up  to  the 
users  of  the  model  to  do  the  fine-tuning.  The  model  accepts  6 
input  parameters  and  produces  the  specified  numbers  of  out¬ 
put  data  points,  which  represent  the  number  of  network  traf¬ 
fic  units  in  a  time  unit  (e.g.,  byte  count  per  0.01  second  on  a 
backbone  network). 

4.2  Procedures 

One  can  use  the  following  steps  to  generate  the  traffic  trace 
specified  in  Section  4.1. 

(1)  Generate  a  FGN  series  {E^,  E2, ...,  Ej.}  of  Hurst 
parameter  H  by  some  known  technique  such  as  Hosking 
Fractional  Differencing.  Notice  that  samples  of  FGN  often 
assume  negative  and  non-integer  values. 

(2)  Translate  Ey  E 2,  ...,  Ej  into  a  positive  series  {F.}  ; 

e.g.  (cf.  [6]),  ( l  -  r)  E 

F.  =  2  (-r  +  e'>  (7) 

where  r  is  an  indicator  of  traffic  denseness,  re  (0,  1)  ,  and 
e  is  a  positive  number  to  make  the  denominator  in  the  above 
exponent  positive. 

(3)  Set  Y.  =  {LF ) /max  {F y  ...,  Fj)  to  ensure  that 
Y.<  L  .  The  traffic  will  be  governed  by  the  (load)  parameter 
Y .  in  each  window,  and  the  traffic  load  will  change  from 
one  window  to  the  next. 

(4)  Repeat  steps  (1)  and  (2),  using  the  Hurst  parameter  Hw, 
to  generate  another  positive  series  G  j,  G2,  ■  Gw .  Fet 
X{  =  G/(Gl  +  G2+  ...  +  Gw)  .  Using  {X.}  and  { T  } 
to  generate  the  trace  {  Z.}  as  specified  by  (6),  the  total  load 
in  each  time  window  of  {Z;.}  satisfies  WZf-w'1  = 
WY  X I W)  =  Y .  <  L  as  desired.  Then  the  integer  parts  of 
{  Z(.}  constitute  the  required  synthetic  trace. 
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We  assign  the  following  values  to  the  6  input  parameters 
to  test  the  model:  H  =  0.99,  //\y  =  0.50,  r  =  0.45,  L  =  106 , 
T  =  W  —  1000.  Therefore,  the  output  trace  has 

N  =  TW  =  106  data  points.  We  arbitrarily  define  each  data 
point  to  be  the  number  of  traffic  bytes  per  0.01  second.  Fig¬ 
ure  1  shows  the  generated  trace  in  four  different  time  scales. 
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Fig.  1  Synthetic  Trace  at  4  Time  Scales:  0.01  -  10 
Seconds  (H  =  0.99,  Hw=  0.50,  r  =  0.45,  L  =  10  6,T=W 
=  10  ).  The  traffic  shows  burstiness  in  all  4  time  scales. 


4.3  Output  Analysis 


extremely  high  degree  of  burstiness  (H  =  1 ).  In  each  vari¬ 
ance-time  plot,  the  line  of  slope  -1  corresponds  to  an  uncor¬ 
related  process  ( (3  =  1 ),  whereas  the  line  of  slope  0 
corresponds  to  an  extremely  bursty  process  (p  =  0).  In 
computing  the  R/S  statistics,  the  n  samples  are  segmented 
into  time  bins  of  equal  size  d.  Therefore,  more  R/S  statistics 
are  produced  for  smaller  values  of  d.  Figure  2  shows  that  the 
generated  trace  indeed  is  SRD  (i.e.,  II w  ~  0.50  )  in  small 
time  scales  and  is  LRD  (i.e.,  H  >  0.9 )  in  larger  time  scales. 

To  see  the  effect  of  the  denseness-indicator  parameter  r , 
we  increase  the  value  of  r  from  0.45  to  0.85  while  keeping 
all  other  parameters  the  same;  and  then  we  plot  the  newly 
generated  trace  in  Figs.  3  and  4.  Comparing  Figs.  1  and  2 
with  Figs.  3  and  4  confirms  that  higher  r  means  denser  traf¬ 
fic  profile.  Comparing  Fig.  2  with  Fig.  4  suggests  that  the 
estimated  Hurst  parameter  seems  to  be  higher  at  higher  r 
(which  is  also  a  measure  of  traffic  load);  this  is  related  to  the 
observation  in  [2]  that  the  degree  of  self-similarity  tends  to 
increase  with  the  load  level  (on  ethernets).  Notice  that  the 
variance-time  and  the  R/S  plots  of  our  synthetic  traffic 
resemble  those  of  the  backbone  traffic  of  a  distributed  inter¬ 
active  simulation  reported  in  [3] ;  our  variance-time  plots  are 
also  comparable  to  those  of  some  TCP  traffic  traces  studied 
in  [5], 


(b)  Variance-Time  Plot 


Fig.  2  Graphical  Statistics  for  the  Generated  Trace  ( H  = 
0.99,  Hw=  0.50,  r  =  0.45,  L  =  106 ,  T=  W=  1000). 


Several  graphical  techniques  exist  for  testing  if  the  generated 
trace  agrees,  to  some  extent,  with  SS  properties  (1)  —  (4).  In 
this  subsection  we  use  two  of  the  most  popular  techniques, 
namely  the  variance-time  and  R/S  plots,  which  are  graphical 
demonstrations  of  (1)  and  (4),  respectively. 

In  each  R/S  plot,  the  straight  line  of  slope  0.5  corresponds 
to  an  uncorrelated  (i.e.,  low  bursty)  process  of  Hurst  parame¬ 
ter  H  =  0.5  ;  the  line  of  slope  1  corresponds  to  a  process  of 


Remark  1:  By  letting  X.  =  T.  when  W  -T  and  H  =  II  w 
in  algorithm  (6),  we  can  generate  a  trace  of  length  T~ ,  which 
is  approximately  SS  with  Hurst  parameter  H.  Therefore,  gen¬ 
erating  a  trace  of  length  n  requires  only  n  cross-multiplica¬ 
tions  and  a  trace  of  length  JJi  (since  n  =  JiiJii).  As  an 
example,  let  H  =  1 1\\  =  0.99,  T=W=  1000;  and  then  use  the 
procedures  in  Section  4.2  with  X.  =  Y. .  Thus  the  mixed 
trace  has  N  =  TW  =  106  data  points  and  is  supposed  to 
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approximate  a  SS  trace  of  Hurst  parameter  0.99  (see  Fig.  5). 
This  combining  method  is  much  faster  than  the  traditional 
start-from-scratch  approach.  The  resultant  R/S,  variance¬ 
time,  power  spectral  density  (periodogram  estimate),  and 
autocorrelation  plots  are  shown  in  Fig.  6,  which  show  that 
our  mixing  algorithm  produces  the  longer  trace  that  inherits 
SS  characteristics  from  the  shorter  trace.  Then  we  estimate 
the  Hurst  parameter  by  linear  fitting  on  all  time  scales:  the 
estimate  from  the  R/S  plot  is  -  0.933;  whereas  that  from  the 
variance-time  plot  is  ~  0.905.  Thus  the  averaged  estimate  for 
the  Hurst  parameter  is  H  ~  0.92,  which  is  93%  of  the  target 
value  (0.99). 
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5  Discussions 

We  form  a  single  longer  trace  by  multiplying  two  shorter  SS 
traces;  the  combined  trace  is  shown  by  examples  to  inherit 
some  SS  characteristics  from  the  shorter  traces.  So  far  the 
two  initial  traces  are  free  of  any  restrictions  besides  the  SS 
assumption.  Suppose  that  the  two  initial  SS  traces  have  the 
same  Hurst  parameter  H  =  1  -  p/2;  naturally  one  would 
ask  the  following  questions  (thanks  to  a  reviewer  for  good 
questions  and  comments).  What  are  sufficient  conditions  that 
the  two  shorter  traces  must  satisfy  to  yield  a  combined  trace 
that  has  high  quality?  Can  the  algorithm  be  used  recursively; 
i.e.,  by  starting  with  two  very  short  traces  and  then  by  repeat¬ 
ing  the  procedure  to  generate  a  very  long  trace?  These  ques¬ 
tions  are  dealt  with  in  [4],  where  we  show  under  mild 
conditions  that  var  ~  ( jW )  ,  which  resembles  (1). 


Fig.  4  R/S  Plot  and  Variance-Time  Plot  for  the  Generated 
Trace  (H  =  0.99,  Hw=  0.50,  r  =  0.85,  L  =  10  6,T=W  = 


1000). 
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Fig.  3  Synthetic  Trace  at  4  Time  Scales:  0.01  -  10 
Seconds  (H  =  0.99,  Hw  =  0.50,  r  =  0.85,  L  =  106,  T=  W 
=  1000).  The  traffic  shows  burstiness  in  all  4  time  scales. 
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Fig.  5  Synthetic  Trace  at  4  Time  Scales:  0.01  -  10 
Seconds  (H  =  Hw=  0.99,  r  =  0.85,  L  =  10  <>,T=W  = 
1000,  X.  =  Y.).  The  traffic  shows  burstiness  in  all  4 
time  scales. 


Time  Lag,  Unit  Time  =  0.01  Second 


Fig.  6  Graphical  Statistics  for  the  Synthetic  Trace  ( T=W 
=  1000,  r  =  0.85,  H  =  H,.,  =  0.99,  X.  =  Y .). 
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